Global Desktop Help! Urgent! Urgent!

[TechSupp]

Right, just created a major problem and somehow changed the security settings on our Global desktop folder. Users now do not have access to the desktop (messasge when logging on) and I cant seem to change any of the security settings.

Was just checking the security settings as someone had managed to add a folder to the desktop and now I 've obviously changed something!!!!

Cant seen to change any security and now even logging on as domain admin I cant even view the contents. Tried a restore from back up, thought that would add previous security but no joy. Any suggestion...fast...welcome!

It says in folder properties that Administrators and Administrator have all allowed permisssions and pupils only the usual read/view etc.

How do I change it back?

Could I rename the folder (destroying the share) then restore the original from backup but would it recreate the share etc or would I be in a worse position? Clutching at straws now!

[TechSupp]

Right, looked at it and found that I must have set admins and users Deny via Security/Advanced/Type was set to Deny. Now set it to Allow and users can load the desktop and as admin I can change settings, however...a general user can now add things to the desktop. What do I need to do as I dont want to end up where I was 10 mins agon, got enough grey hair!

[Jamman960]

adding a write deny for teachers/students should sort it, other than that use the effective permissions options to see what certain users can do as you tweak the perms

 

James

Edited May 19, 2011 by Jamman960
Spelling

[TechSupp]

Now, looking at the perms (properties, security tab) I have the pupil group with Read/Execute, List and Read yet they still can add to the desktop? Now they are local admins and in the desktop folder I have a Administrator and domain\Administrators group with full control should that have any bearing on it or should I only have domain\administrator group in the list?

Getting headache now! If I need tio change perms can I have dummy instructions please

 

Would a restore from backup cure all now I can actually write and view the folder?

 

Edit: Think I have it now, re-read your post and added the Write Deny, was thinking just not ticking the allow write would do it, hey ho!

Edited May 19, 2011 by TechSupp

[Jamman960]

Not ticking the allow write should do it but it sounds as though one of the groups they are members of still has write permissions, I'd be very carefull giving non-admin users local admin rights, if you really have to give them extra perms for some reason try giving them power user rights first or give them extra access to specific folders/registry keys via GPO's.

 

I would have thought deleting and restoring would reset the permissions although they may just inherit the perms from above.

Edited May 19, 2011 by Jamman960

[TechSupp]

Thanks, as i said done the deny write and all ok so far. Thanks. Just for future ref if i had deleted the folder and its share would a restore from ntbackup 2008 have restored the.folder.permissions and share? Or would i have had problems restoring a share that already existed. Had that with printers not allowing a newprinter to have an old printers share name whicv was removed as printer had been deleted. Would have given you thanks but cant see the button somehow.

[morganw]

It depends on what you restore, the share settings aren't linked to any meta data in the folders. If you the shares are gone you would also have to restore the share definitions back to the registry (HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares). Maybe the restore process would handle this for you but it's worth checking the before and after states to see exactly what went on. Folder permissions should be restored as long as you don't stage the restore across another file system that would strip the permissions, e.g. a FAT32 formatted memory stick.

[TechSupp]

Just as an addition to this thread, I went to the only other school I have running a global desktop for pupil logons only and noticed it had the group 'everyone' with the ability to read, list etc but with write deny. It also has Administrators and pupils groups in with the usual read list etc but not deny write. I didnt set this up in the first place so can I get rid of the everyone as it seems daft to have it as to lock it down I have to have deny write for everyone group then when I want to change an icon I have to remnove the write deny, change icon then reset it. Not really looked at it much before because it just worked, now after my problem started to look a bit more closely.